SpringSecurity基于散列加密方案实现自动登录

目录

• 前言
• 一. 自动登录简介

• 1. 为什么要自动登录
• 2. 自动登录的实现方案

• 1. 配置加密令牌的key
• 2. 配置SecurityConfig类
• 3. 添加测试接口
• 4. 启动项目测试

• 1. cookie的加密原理分析
• 2. cookie的解码原理分析
• 3. 自动登录的源码分析

spring:
  datasource:
    url: jdbc:mysql://localhost:3306/db-security?useUnicode=true&characterEncoding=utf-8&useSSL=false&serverTimezone=GMT
    username: root
    password: syc
  security:
    remember-me:
      key: yyg

@EnableWebSecurity(debug = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Value("${spring.security.remember-me.key}")
    private String rememberKey;
    @Autowired
    private UserDetailsService userDetailsService;
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //利用JdbcTokenRepositoryImpl关联数据源
        JdbcTokenRepositoryImpl tokenRepository = new JdbcTokenRepositoryImpl();
        tokenRepository.setDataSource(dataSource);
        http.authorizeRequests()
                .antMatchers("/admin/**")
                .hasRole("ADMIN")
                .antMatchers("/user/**")
                .hasRole("USER")
                .antMatchers("/app/**")
                .permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .formLogin()
                .permitAll()
                .and()
            	//开启“记住我”功能
                .rememberMe()
                .userDetailsService(userDetailsService)
                //配置散列加密用的key
                .key(rememberKey)
                .and()
                .csrf()
                .disable();
    }
    @Bean
    public PasswordEncoder passwordEncoder() {
        //不对登录密码进行加密
        return NoOpPasswordEncoder.getInstance();
    }
}

@RestController
@RequestMapping("/user")
public class UserController {
    @GetMapping("hello")
    public String hello() {
        return "hello, user";
    }
}

//对各字段进行散列加密
hashInfo=md5Hex(username +":"+expirationTime +":"password+":"+key)
//利用base64进行解码
rememberCookie=base64(username+":"+expirationrime+":"+hashInfo)

@Override
public void onLoginSuccess(HttpServletRequest request, HttpServletResponse response,
  Authentication successfulAuthentication) {
    //从认证对象中获取用户名
 	String username = retrieveUserName(successfulAuthentication);
    //从认证对象中获取密码
 	String password = retrievePassword(successfulAuthentication);
    ......
 	if (!StringUtils.hasLength(password)) {
        //根据用户名查询出对应的用户
 	 	UserDetails user = getUserDetailsService().loadUserByUsername(username);
        //获取到用户身上的密码
  		password = user.getPassword();
 	}
    //获取登录过期时间，默认是2周
 	int tokenLifetime = calculateLoginLifetime(request, successfulAuthentication);
 	long expiryTime = System.currentTimeMillis();
 	expiryTime += 1000L * (tokenLifetime < 0 ? TWO_WEEKS_S : tokenLifetime);
    //生成remember-me签名信息
 	String signatureValue = makeTokenSignature(expiryTime, username, password);
    //保存cookie
 	setCookie(new String[] { username, Long.toString(expiryTime), signatureValue },
    tokenLifetime, request, response);
}
protected String makeTokenSignature(long tokenExpiryTime, String username,
  String password) {
 	String data = username + ":" + tokenExpiryTime + ":" + password + ":" + getKey();
 	MessageDigest digest;
 	digest = MessageDigest.getInstance("MD5");
 	return new String(Hex.encode(digest.digest(data.getBytes())));
}

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
			throws IOException, ServletException {
		HttpServletRequest request = (HttpServletRequest) req;
		HttpServletResponse response = (HttpServletResponse) res;
		if (SecurityContextHolder.getContext().getAuthentication() == null) {
            //处理自动登录的业务逻辑
			Authentication rememberMeAuth = rememberMeServices.autoLogin(request,
					response);
			if (rememberMeAuth != null) {
				// Attempt authenticaton via AuthenticationManager
				try {
					rememberMeAuth = authenticationManager.authenticate(rememberMeAuth);
					// Store to SecurityContextHolder
					SecurityContextHolder.getContext().setAuthentication(rememberMeAuth);
					onSuccessfulAuthentication(request, response, rememberMeAuth);
					if (logger.isDebugEnabled()) {
						logger.debug("SecurityContextHolder populated with remember-me token: '"
								+ SecurityContextHolder.getContext().getAuthentication()
								+ "'");
					}
					// Fire event
					if (this.eventPublisher != null) {
						eventPublisher
								.publishEvent(new InteractiveAuthenticationSuccessEvent(
										SecurityContextHolder.getContext()
												.getAuthentication(), this.getClass()));
					}
					if (successHandler != null) {
						successHandler.onAuthenticationSuccess(request, response,
								rememberMeAuth);
						return;
					}
				}
				catch (AuthenticationException authenticationException) {
					if (logger.isDebugEnabled()) {
						logger.debug(
								"SecurityContextHolder not populated with remember-me token, as "
										+ "AuthenticationManager rejected Authentication returned by RememberMeServices: '"
										+ rememberMeAuth
										+ "'; invalidating remember-me token",
								authenticationException);
					}
					rememberMeServices.loginFail(request, response);
					onUnsuccessfulAuthentication(request, response,
							authenticationException);
				}
			}
			chain.doFilter(request, response);
		}
		else {
			if (logger.isDebugEnabled()) {
				logger.debug("SecurityContextHolder not populated with remember-me token, as it already contained: '"
						+ SecurityContextHolder.getContext().getAuthentication() + "'");
			}
			chain.doFilter(request, response);
		}
	}

    @Override
	public final Authentication autoLogin(HttpServletRequest request,
			HttpServletResponse response) {
		String rememberMeCookie = extractRememberMeCookie(request);
		if (rememberMeCookie == null) {
			return null;
		}
		logger.debug("Remember-me cookie detected");
		if (rememberMeCookie.length() == 0) {
			logger.debug("Cookie was empty");
			cancelCookie(request, response);
			return null;
		}
		UserDetails user = null;
		try {
			String[] cookieTokens = decodeCookie(rememberMeCookie);
			user = processAutoLoginCookie(cookieTokens, request, response);
			userDetailsChecker.check(user);
			logger.debug("Remember-me cookie accepted");
			return createSuccessfulAuthentication(request, user);
		}
		......
		cancelCookie(request, response);
		return null;
	}